Support proxy environment variables for Codex WebSockets

[ItsAlbertZhang]

Problem

The Codex WebSocket transport currently uses tokio-tungstenite::connect_async, which opens a direct connection and does not honor HTTP_PROXY, HTTPS_PROXY, ALL_PROXY, or NO_PROXY.

This means users behind a standard HTTP proxy may need TUN/global routing even though WebSocket starts as an HTTP Upgrade.

Proposed solution

I have a local implementation that:

• Performs the WebSocket Upgrade through a proxy-aware reqwest client.
• Supports HTTP forwarding for ws:// and HTTP CONNECT for wss://.
• Honors uppercase and lowercase proxy variables, ALL_PROXY fallback, NO_PROXY, and Basic proxy authentication.
• Keeps Auto transport fallback on the same proxy route instead of silently connecting directly.
• Preserves native TLS roots and redacts proxy credentials.

Local tests cover proxy selection, authentication, bypass rules, CONNECT rejection, Auto fallback routing, and existing WebSocket behavior. I have not performed a live external Codex test yet.

If this direction seems useful, I would be happy to open a PR with the implementation. Would the maintainers be open to considering it?

[raine]

Hey, feel free to open. Thanks